Problem: Risk assessment should be conducted periodically to measure and monitor the effectiveness of security controls. For a large hospital or major health care provider, what is the advantage and disadvantage of conducting a risk assessment annually vs. monthly?